Menu

Search for hundreds of thousands of exploits

"A10 Networks Loadbalancer - Directory Traversal"

Author

Exploit author

xistence

Platform

Exploit platform

hardware

Release date

Exploit published date

2014-01-29

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
-----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

A10 Networks Loadbalancer (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217

-------------------------
Affected vendors:
-------------------------

A10Networks
http://www.a10networks.com/

-------------------------
Product description:
-------------------------

SupportCenter Plus is a web-based customer support software that lets
organizations effectively manage customer tickets,
their account & contact information, the service contracts and in the
process providing a superior customer experience.

----------
Details:
----------

[ 0x01 - Directory Traversal ]

A10 Networks (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217 is prone to an
unauthenticated directory traversal vulnerability.
It's possible to download any file on the remote AX device with root
privileges, without the need to authenticate to the website.

The bug was fixed earlier in A10 Tracking ID "82150" according to the
release notes, however the fix is not sufficient and can be bypassed.

The new protection seems to make sure files are under the /a10data/tmp dir
(https://<IP>/xml/downloads/?filename=/a10data/tmp/).

By sending a GET request to
"https://<IP>/xml/downloads/?filename=/a10data/tmp/../.."
and thus keeping /a10data/tmp, we can bypass this. So if we would like
to download the file /etc/shadow we send a GET request to "https://
<IP>/xml/downloads/?filename=/a10data/tmp/../../etc/passwd".

Or if we would like to download a certificate key file: "https://
<IP>/xml/downloads/?filename=/a10data/tmp/../../a10data/key/domain.com"

WARNING: Downloading a file will delete it from the AX device!


-----------
Solution:
-----------

Upgrade to a newer version.

--------------
Timeline:
--------------

Fixed somewhere back in 2013 :)
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-11-30 "ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure" webapps hardware "Zagros Bingol"
2020-11-30 "Intelbras Router RF 301K 1.1.2 - Authentication Bypass" webapps hardware "Kaio Amaral"
2020-11-27 "Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution" webapps hardware "Emre SUREN"
2020-11-24 "Seowon 130-SLC router 1.0.11 - 'ipAddr' RCE (Authenticated)" webapps hardware maj0rmil4d
2020-11-23 "TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass" webapps hardware malwrforensics
2020-11-19 "Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification" webapps hardware "Ricardo Longatto"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-16 "Cisco 7937G - DoS/Privilege Escalation" remote hardware "Cody Martin"
2020-11-13 "ASUS TM-AC1900 - Arbitrary Command Execution (Metasploit)" webapps hardware b1ack0wl
2020-11-13 "Citrix ADC NetScaler - Local File Inclusion (Metasploit)" webapps hardware "RAMELLA Sebastien"
Release Date Title Type Platform Author
2015-10-05 "ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal" webapps jsp xistence
2015-09-14 "ManageEngine OpManager 11.5 - Multiple Vulnerabilities" webapps multiple xistence
2015-09-14 "ManageEngine EventLog Analyzer < 10.6 build 10060 - SQL Execution" webapps multiple xistence
2014-03-19 "Quantum DXi V1000 2.2.1 - Static SSH Key" remote unix xistence
2014-03-19 "Quantum vmPRO 3.1.2 - Local Privilege Escalation" local hardware xistence
2014-03-19 "Array Networks vxAG 9.2.0.34 and vAPV 8.3.2.17 - Multiple Vulnerabilities" webapps hardware xistence
2014-03-19 "Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key" remote unix xistence
2014-02-05 "Pandora Fms 5.0RC1 - Remote Command Injection" webapps php xistence
2014-01-29 "ManageEngine Support Center Plus 7916 - Directory Traversal" webapps php xistence
2014-01-29 "A10 Networks Loadbalancer - Directory Traversal" webapps hardware xistence
2013-10-04 "Aanval 7.1 build 70151 - Multiple Vulnerabilities" webapps php xistence
2013-09-20 "Western Digital Arkeia < 10.0.10 - Remote Code Execution (Metasploit)" remote php xistence
2013-09-20 "OpenEMR 4.1.1 Patch 14 - SQL Injection / Privilege Escalation / Remote Code Execution (Metasploit)" remote php xistence
2013-09-17 "Western Digital Arkeia Appliance 10.0.10 - Multiple Vulnerabilities" webapps php xistence
2013-09-17 "OpenEMR 4.1.1 Patch 14 - Multiple Vulnerabilities" webapps php xistence
2013-09-03 "TP-Link TD-W8951ND - Multiple Vulnerabilities" webapps hardware xistence
2013-07-25 "Alienvault Open Source SIEM (OSSIM) - Multiple Cross-Site Scripting Vulnerabilities" webapps php xistence
2013-06-26 "Motion - Multiple Vulnerabilities" remote multiple xistence
2013-01-02 "Astium VoIP PBX 2.1 build 25399 - Multiple Vulnerabilities/Remote Command Execution" webapps php xistence
2013-01-02 "Astium VoIP PBX 2.1 build 25399 - Remote Crash (PoC)" dos linux xistence
2012-12-29 "Ubiquiti AirOS 5.5.2 - (Authenticated) Remote Command Execution" remote hardware xistence
2012-12-21 "YeaLink IP Phone SIP-TxxP Firmware 9.70.0.100 - Multiple Vulnerabilities" webapps hardware xistence
2012-10-19 "ManageEngine Security Manager Plus 5.5 build 5505 - Remote SYSTEM SQL Injection (Metasploit)" remote windows xistence
2012-10-19 "ManageEngine Security Manager Plus 5.5 build 5505 - Remote Root/SYSTEM SQL Injection" remote multiple xistence
2012-10-19 "ManageEngine Security Manager Plus 5.5 build 5505 - Directory Traversal" webapps multiple xistence
2012-10-17 "ManageEngine Support Center Plus 7908 - Multiple Vulnerabilities" webapps jsp xistence
2012-04-15 "ManageEngine Support Center Plus 7903 - Multiple Vulnerabilities" webapps multiple xistence
2011-06-23 "ManageEngine Support Center Plus 7.8 Build 7801 - Directory Traversal" webapps jsp xistence 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected